1

I am trying to test out by setting up SSO in my trailhead org. Following these steps - https://help.salesforce.com/s/articleView?id=sf.sso_service_provider_configuration.htm&type=5

I setup SSO like this:

enter image description here

I used https://axiomsso.herokuapp.com/Home.action to help with setting up an IDP. AND used this https://axiomsso.herokuapp.com/SamlIdpResponseAndTargetPosterForm.action to do the login after setting up SSO in SF.

The SAML assertion response is this:

<?xml version="1.0" encoding="UTF-8"?>
<saml1p:Response xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol" IssueInstant="2023-11-21T20:09:20.229Z" MajorVersion="1" MinorVersion="1" Recipient="https://cunning-impala-k2qke1-dev-ed.trailblaze.my.salesforce.com" ResponseID="_4aac2d37-1591ff76">
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
            <ds:Reference URI="#_4aac2d37-1591ff76">
                <ds:Transforms>
                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                </ds:Transforms>
                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <ds:DigestValue>pNRVYUBQPfBPfOQ0kR6FCe8pfkM=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>azD+J85W6BoULPi6bFmhWhUPJb1J6f8HI7Y9662wHjQOyuaamerMdg==</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>MIID0zCCA5GgAwIBAgIEF/uFITALBgcqhkjOOAQDBQAwgboxCzAJBgNVBAYTAlVTMQswCQYDVQQI
EwJDQTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzESMBAGA1UEChMJQXhpb20gU1NPMVEwTwYDVQQL
E0hGT1IgREVNT05TVFJBVElPTiBQVVJQT1NFUyBPTkxZLiBETyBOT1QgVVNFIEZPUiBQUk9EVUNU
SU9OIEVOVklST05NRU5UUy4xHzAdBgNVBAMTFkF4aW9tIERlbW8gQ2VydGlmaWNhdGUwHhcNMTQw
NjIwMDQzMDI3WhcNNDExMTA1MDQzMDI3WjCBujELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYw
FAYDVQQHEw1TYW4gRnJhbmNpc2NvMRIwEAYDVQQKEwlBeGlvbSBTU08xUTBPBgNVBAsTSEZPUiBE
</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml1p:Status>
        <saml1p:StatusCode Value="saml1p:Success"/>
    </saml1p:Status>
    <saml1:Assertion xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion" AssertionID="_7dad73d9-13acc6a0" IssueInstant="2023-11-21T20:09:20.229Z" Issuer="Heroku" MajorVersion="1" MinorVersion="1">
        <saml1:Conditions NotBefore="2023-11-21T20:09:20.229Z" NotOnOrAfter="2023-11-21T20:10:20.229Z">
            <saml1:AudienceRestrictionCondition>
                <saml1:Audience>https://saml.salesforce.com</saml1:Audience>
            </saml1:AudienceRestrictionCondition>
        </saml1:Conditions>
        <saml1:AuthenticationStatement AuthenticationInstant="2023-11-21T20:09:20.229Z" AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified">
            <saml1:Subject>
                <saml1:NameIdentifier>[email protected]</saml1:NameIdentifier>
                <saml1:SubjectConfirmation>
                    <saml1:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml1:ConfirmationMethod>
                </saml1:SubjectConfirmation>
            </saml1:Subject>
        </saml1:AuthenticationStatement>
    </saml1:Assertion>
</saml1p:Response>

This what Axiom IDP login Page look like:

enter image description here

When I click login I get this screen:

enter image description here

When I used SAMPL validator I get this screen:

enter image description here

Does it mean that SAML generated with https://axiomsso.herokuapp.com/SamlIdpHome.action is in 1.1 version and can't be used? Can I not setup and test SSO like this?ANything I am missing?

Is there any other suggestion how I can create and test a sample SSO? If I can use another IDP that is public then pls let me know.

1 Answer 1

0

I see some glaring mistakes.

  1. Entity ID should be the domain name of your Salesforce instance (which should be the same name as your Login URL in your first screenshot)
  2. Issuer should not be Heroku think it should be (https://axiomsso.herokuapp.com
  3. Why are you using Username rather than Federation ID? and HTTP POST rather than HTTP Redirect?

You can reference this post for this SSO testing

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .